netdev - [PATCH] ip maddr show” on an infiniband address causes a stack corruption

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <492BF146.5010808@redhat.com>
Date:	Tue, 25 Nov 2008 12:36:22 +0000
From:	Olivier Fourdan <ofourdan@...hat.com>
To:	netdev@...r.kernel.org
Subject: [PATCH] ip maddr show” on an infiniband address causes a stack corruption

Hi,

“ip maddr show” on an infiniband address causes a stack corruption 
because the length of the address for Infiniband (20 bytes, as 
described in kernel doc Documentation/infiniband/ipoib.txt) does not 
fit on the 16 bytes of the field in which it gets stored.

The proposed patch increases the size of the hardware address from 4 
__u32 to 8 and also adds a check to avoid overriding the available 
size while parsing the hardware address.

This bug affects current upstream code AFAICT.

Hope this helps,
Cheers,
Olivier.

View attachment "iproute2-2.6.26-check-hwaddr-size.patch" of type "text/x-patch" (1816 bytes)